cnx-network-clan/modules/router/proxy.nix

# Internal reverse proxy for the gateway: Caddy terminates TLS for
# <service>.<site><siteId>.cnx.network (e.g. omada.cnx1.cnx.network) and
# forwards to backends by their internal address. The cert is a real Let's
# Encrypt wildcard (*.<site><siteId>.cnx.network) obtained via ACME DNS-01
# against ns1 with a gateway-scoped TSIG key, so browsers trust it without
# any CA install; the names only *resolve* internally — Blocky answers them
# with the router's LAN address, the public zone never carries them.
#
# Requires the machine to also import the shared secret generator:
#   (import ../../modules/dns/acme-gw-secret.nix "<hostname>")
# and ns1 to hold the matching key + acl (see machines/ns1/configuration.nix).
{
  config,
  lib,
  ...
}:
let
  cfg = config.cnx.router;
  hosts = import ../hosts.nix;
  hostname = config.networking.hostName;
  tsigKey = "acme_${lib.replaceStrings [ "-" ] [ "_" ] hostname}";
  certName = "${cfg.site}${toString cfg.siteId}.cnx.network";

  serviceModule = {
    options = {
      backend = lib.mkOption {
        type = lib.types.str;
        example = "https://127.0.0.1:8043";
        description = "URL Caddy forwards to (internal/mesh address).";
      };
      insecureSkipVerify = lib.mkOption {
        type = lib.types.bool;
        default = false;
        description = "Skip TLS verification towards the backend (self-signed upstreams like Omada).";
      };
    };
  };
in
{
  options.cnx.router.proxy = {
    enable = lib.mkEnableOption "internal reverse proxy (Caddy, wildcard cert via DNS-01)";

    services = lib.mkOption {
      type = lib.types.attrsOf (lib.types.submodule serviceModule);
      default = { };
      description = "Proxied services; attr name becomes <name>.${certName}.";
    };

    allowVlans = lib.mkOption {
      type = lib.types.listOf lib.types.str;
      default = [
        "mgmt"
        "lan"
      ];
      description = "VLANs whose clients may reach the proxy (443, plus 80 for the redirect).";
    };
  };

  config = lib.mkIf (cfg.enable && cfg.proxy.enable) {
    assertions = [
      {
        assertion = lib.all (v: cfg.vlans ? ${v}) cfg.proxy.allowVlans;
        message = "cnx.router.proxy.allowVlans must name VLANs defined in cnx.router.vlans.";
      }
    ];

    # Render the shared per-gateway TSIG secret into a lego rfc2136 env file;
    # same pattern as web01 (modules/web-proxy.nix), scoped on ns1 to
    # _acme-challenge.<site><siteId> TXT records only.
    clan.core.vars.generators."dns-acme-${hostname}-rfc2136" = {
      files."rfc2136.env".secret = true; # root-owned; systemd reads it as root
      dependencies = [ "dns-acme-${hostname}-secret" ];
      script = ''
        printf 'RFC2136_NAMESERVER=${hosts.ns1.ipv4}:53\nRFC2136_TSIG_ALGORITHM=hmac-sha256.\nRFC2136_TSIG_KEY=${tsigKey}\nRFC2136_TSIG_SECRET=%s\n' \
          "$(cat "$in"/dns-acme-${hostname}-secret/secret)" > "$out"/rfc2136.env
      '';
    };

    security.acme = {
      acceptTerms = true;
      defaults.email = "postmaster@cnx.email";
      # One wildcard for every proxied service; DNS-01 against ns1, so issuance
      # works behind PPPoE with no inbound reachability at all.
      certs.${certName} = {
        domain = "*.${certName}";
        dnsProvider = "rfc2136";
        environmentFile =
          config.clan.core.vars.generators."dns-acme-${hostname}-rfc2136".files."rfc2136.env".path;
        # ns1 is the only nameserver that accepts this key's UPDATE; check
        # propagation against it directly rather than a public resolver.
        dnsResolver = "${hosts.ns1.ipv4}:53";
        # Caddy reads the cert from explicit file paths (tls directive below),
        # so it won't notice a renewal on its own.
        reloadServices = [ "caddy.service" ];
      };
    };

    # The lego-issued cert is owned group=acme; Caddy needs to read the key.
    users.users.caddy.extraGroups = [ "acme" ];

    # The explicit `tls cert key` points Caddy at the wildcard cert and disables
    # its automatic ACME, so no extra issuance happens.
    services.caddy = {
      enable = true;
      virtualHosts = lib.mapAttrs' (
        name: svc:
        lib.nameValuePair "${name}.${certName}" {
          extraConfig = ''
            tls /var/lib/acme/${certName}/cert.pem /var/lib/acme/${certName}/key.pem
            ${
              if svc.insecureSkipVerify then
                ''
                  reverse_proxy ${svc.backend} {
                    transport http {
                      tls_insecure_skip_verify
                    }
                  }''
              else
                "reverse_proxy ${svc.backend}"
            }
          '';
        }
      ) cfg.proxy.services;
    };

    # Blocky answers <anything>.<site><siteId>.cnx.network (customDNS covers
    # subdomains) with the router's LAN address — clients on any allowed VLAN
    # reach that address through the router's input path.
    services.blocky.settings.customDNS.mapping.${certName} = cfg.vlans.lan.address;

    # 443 serves the proxy; 80 only carries Caddy's automatic HTTP->HTTPS
    # redirect. mgmt is already a trusted interface; listed anyway so shrinking
    # trustedInterfaces later doesn't silently break the proxy.
    networking.firewall.interfaces = lib.genAttrs (map (v: "vlan-${v}") cfg.proxy.allowVlans) (_: {
      allowedTCPPorts = [
        80
        443
      ];
    });
  };
}